# Latest **URL:** https://discuss.elastic.co/latest.md?page=1896 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1897 --- ## [Merge two elasticsearch clusters](https://discuss.elastic.co/t/merge-two-elasticsearch-clusters/260678)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 11:31am UTC](https://discuss.elastic.co/t/merge-two-elasticsearch-clusters/260678 "2021-01-13T11:31:11Z")
Hi All, Currently we have two clusters, in one we have 4 nodes(1 coordinating, 3 data nodes out of which two are master) and second cluster(1 coordinating, 5 data nodes out of which three are master). Can someone sugges… --- ## [Kubernetes How disable SSL getting Elasticsearch Unreachable: \[https://elastic:xxxxxx@myhost.elastic-namespace.svc:9200/](https://discuss.elastic.co/t/kubernetes-how-disable-ssl-getting-elasticsearch-unreachable-https-elastic-xxxxxx-myhost-elastic-namespace-svc-9200/260985)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 11:18am UTC](https://discuss.elastic.co/t/kubernetes-how-disable-ssl-getting-elasticsearch-unreachable-https-elastic-xxxxxx-myhost-elastic-namespace-svc-9200/260985 "2021-01-13T11:18:11Z")
i saw a lot of problems with this issue, looks like it is impossible to disable the SSL in logstash when connecting to elasticsearch i want to disable it , i don't what to use it this is an internal app. this configura… --- ## [Monitoring issue](https://discuss.elastic.co/t/monitoring-issue/260981)
**Author:** [@Makss39](https://discuss.elastic.co/u/Makss39)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 11:18am UTC](https://discuss.elastic.co/t/monitoring-issue/260981 "2021-01-13T11:18:09Z")
Hi there, I'm facing an issue with monitoring. I setted up end december and it worked like a charm with metricbeat. Now when i' going on the monitoring page in Kibana i get "No monitoring data found". No idea why... A… --- ## [No more logs in ELK](https://discuss.elastic.co/t/no-more-logs-in-elk/260314)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 3\ **Last updated:** [January 13, 2021, 11:07am UTC](https://discuss.elastic.co/t/no-more-logs-in-elk/260314 "2021-01-13T11:07:05Z")
Hello everyone, I'm new here and I've been using the ELK stack recently. I am in apprenticeship in my company and I am asked to take over the SIEM because nobody knows how to use it. (It was implemented by a previous ap… --- ## [How to make Point In Time API request using JAVA REST High Level Client](https://discuss.elastic.co/t/how-to-make-point-in-time-api-request-using-java-rest-high-level-client/260965)
**Author:** [@Shalika](https://discuss.elastic.co/u/Shalika)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 10:54am UTC](https://discuss.elastic.co/t/how-to-make-point-in-time-api-request-using-java-rest-high-level-client/260965 "2021-01-13T10:54:37Z")
It will be helpful if someone can point me to a way to execute Point In Time API request, which is newly introduced in Elasticsearch 7.10.1, from JAVA using REST high-level client or any other way in JAVA. (except Transp… --- ## [Elasticsearch BulkRequestHandler listener callback execution](https://discuss.elastic.co/t/elasticsearch-bulkrequesthandler-listener-callback-execution/260978)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 10:48am UTC](https://discuss.elastic.co/t/elasticsearch-bulkrequesthandler-listener-callback-execution/260978 "2021-01-13T10:48:55Z")
In line https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/action/bulk/BulkRequestHandler.java#L58 Curious why the semaphore is acquired after the beforeBulk callback? While not … --- ## [Create a new metric for metricbeat](https://discuss.elastic.co/t/create-a-new-metric-for-metricbeat/260977)
**Author:** [@MatteoM](https://discuss.elastic.co/u/MatteoM)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 10:48am UTC](https://discuss.elastic.co/t/create-a-new-metric-for-metricbeat/260977 "2021-01-13T10:48:50Z")
Hi there! I'm new in the forum and even to elasticsearch and kibana. For an university project I have to monitor several docker container created with marathon. Initially I've used zabbix to get the docker metrics for… --- ## [Ik 做不到分詞searching](https://discuss.elastic.co/t/ik-searching/260973)
**Author:** [@Tails](https://discuss.elastic.co/u/Tails)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 10:40am UTC](https://discuss.elastic.co/t/ik-searching/260973 "2021-01-13T10:40:29Z")
入了 "張學友" 去dictionary 張學友 searching 正常 \[root@localhost scripts\]# curl -H 'Content-Type: application/json' -XPOST 'http://192.168.90.13:9200/p\_photo/\_search?pretty' -d' { "query" : { "term" : { "caption" : "張學友" }} }… --- ## [Auditbeat socket dataset doesn't correlate process info](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 4\ **Last updated:** [January 13, 2021, 10:08am UTC](https://discuss.elastic.co/t/auditbeat-socket-dataset-doesnt-correlate-process-info/260844 "2021-01-13T10:08:49Z")
Why are some events in my socket dataset missing process info? --- ## [Indices.breaker.total.use\_real\_memory or search.check\_buckets\_step\_size  didn't work](https://discuss.elastic.co/t/indices-breaker-total-use-real-memory-or-search-check-buckets-step-size-didnt-work/260945)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 7:38am UTC](https://discuss.elastic.co/t/indices-breaker-total-use-real-memory-or-search-check-buckets-step-size-didnt-work/260945 "2021-01-13T07:38:19Z")
I always thought that with this new parameter, requests for too many buckets should be rejected。But I tested it today, making two requests and creating hundreds of thousands of buckets per request。In the end, the machine… --- ## [Bar Chart X-Axis Text Alignment](https://discuss.elastic.co/t/bar-chart-x-axis-text-alignment/260667)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 3\ **Last updated:** [January 13, 2021, 9:44am UTC](https://discuss.elastic.co/t/bar-chart-x-axis-text-alignment/260667 "2021-01-13T09:44:54Z")
Hi, How do i set the text alignment on the X-Axis to vertical ? This bar chart created using Date Histogram where minimum interval = Day. I further aggregate the data using Split series and my Sub aggregation type is '… --- ## [All shards failed - 400 happens on certain indexes](https://discuss.elastic.co/t/all-shards-failed-400-happens-on-certain-indexes/260960)
**Author:** [@Yoav\_Alroy](https://discuss.elastic.co/u/Yoav_Alroy)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 9:26am UTC](https://discuss.elastic.co/t/all-shards-failed-400-happens-on-certain-indexes/260960 "2021-01-13T09:26:06Z")
Hi, A bit of a background - We are using ElasticSearch with index per client for search engine. Now we let the user have several types of search terms that one of them is "search by id" where we focus the search to cer… --- ## [Is it possible to fetch count of total number of docs that qualify an aggregation condition in elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-fetch-count-of-total-number-of-docs-that-qualify-an-aggregation-condition-in-elasticsearch/260958)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 9:11am UTC](https://discuss.elastic.co/t/is-it-possible-to-fetch-count-of-total-number-of-docs-that-qualify-an-aggregation-condition-in-elasticsearch/260958 "2021-01-13T09:11:17Z")
--- ## [Discovery configuration changes in 7.x](https://discuss.elastic.co/t/discovery-configuration-changes-in-7-x/260522)
**Author:** [@srikanth\_k](https://discuss.elastic.co/u/srikanth_k)\ **Replies:** 6\ **Last updated:** [January 13, 2021, 9:33am UTC](https://discuss.elastic.co/t/discovery-configuration-changes-in-7-x/260522 "2021-01-13T09:33:18Z")
Before an upgrade to 7.x, why is it required to set the below value discovery.zen.ping.unicast.hosts ? " After the cluster forms successfully for the first time, remove the cluster.initial\_master\_nodes setting from eac… --- ## [Java Agent -100% CPU](https://discuss.elastic.co/t/java-agent-100-cpu/260942)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 2\ **Last updated:** [January 13, 2021, 9:20am UTC](https://discuss.elastic.co/t/java-agent-100-cpu/260942 "2021-01-13T09:20:35Z")
Hey, We use the APM Java Agent 1.20.0 on Java 1.8.0\_162 with apm-server 7.10.1 and strangely on two of our Hosts we get system.process.cpu.total.norm.pct: -100% system.cpu.total.norm.pct: -100% On identical Hosts we … --- ## [Hyphens in queries are ignored on Powershell Logs collected by Elastic Agent and Winlogbeat](https://discuss.elastic.co/t/hyphens-in-queries-are-ignored-on-powershell-logs-collected-by-elastic-agent-and-winlogbeat/259537)
**Author:** [@j0nh](https://discuss.elastic.co/u/j0nh)\ **Replies:** 3\ **Last updated:** [January 13, 2021, 8:56am UTC](https://discuss.elastic.co/t/hyphens-in-queries-are-ignored-on-powershell-logs-collected-by-elastic-agent-and-winlogbeat/259537 "2021-01-13T08:56:07Z")
The Problem When dealing with Powershell Logs collected by both Elastic Agent and winlogbeat, I'm dealing with the following problem: Hyphens are ignored and contains queries don't work properly For example: Queries… --- ## [Hey i want to add some text into my message can anybody help me how to do it?](https://discuss.elastic.co/t/hey-i-want-to-add-some-text-into-my-message-can-anybody-help-me-how-to-do-it/260321)
**Author:** [@jolaniya](https://discuss.elastic.co/u/jolaniya)\ **Replies:** 4\ **Last updated:** [January 13, 2021, 8:51am UTC](https://discuss.elastic.co/t/hey-i-want-to-add-some-text-into-my-message-can-anybody-help-me-how-to-do-it/260321 "2021-01-13T08:51:23Z")
Hey i want to add some text into my message can anybody help me how to do it? --- ## [Elasticsearch custom users with custom keys in existing Secret config](https://discuss.elastic.co/t/elasticsearch-custom-users-with-custom-keys-in-existing-secret-config/260950)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 8:50am UTC](https://discuss.elastic.co/t/elasticsearch-custom-users-with-custom-keys-in-existing-secret-config/260950 "2021-01-13T08:50:58Z")
File realm doc provides example on how to define users and roles by Secret Kubernetes configuration with use of keys users and users\_roles and referring to this with spec.auth.fileRealm from Elasticsearch configuration. … --- ## [What value adds Data Streams vs Index Alias for time series data](https://discuss.elastic.co/t/what-value-adds-data-streams-vs-index-alias-for-time-series-data/260948)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 7:51am UTC](https://discuss.elastic.co/t/what-value-adds-data-streams-vs-index-alias-for-time-series-data/260948 "2021-01-13T07:51:50Z")
I'm struggling to understand what benefits Data Streams brings to the table, compared with Index Alias for time series data? Are there any performance (i.e indexing and querying) benefits? --- ## [Invalid format: \[yyyy-MM-ddTHH:mm:ssZ\]: Unknown pattern letter: T"](https://discuss.elastic.co/t/invalid-format-yyyy-mm-ddthhssz-unknown-pattern-letter-t/260874)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 2\ **Last updated:** [January 13, 2021, 7:45am UTC](https://discuss.elastic.co/t/invalid-format-yyyy-mm-ddthhssz-unknown-pattern-letter-t/260874 "2021-01-13T07:45:30Z")
Hello team, strange thing happened. I have following mapping for the field in els with multiple formats: "createdAt" : { "type" : "date", "format" : "yyyy-MM-dd HH:mm:ssZ||yyyy-MM-dd… --- ## [Filebeat docker container with python 3. How to?](https://discuss.elastic.co/t/filebeat-docker-container-with-python-3-how-to/260946)
**Author:** [@Sreekanth\_Mannari](https://discuss.elastic.co/u/Sreekanth_Mannari)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 7:42am UTC](https://discuss.elastic.co/t/filebeat-docker-container-with-python-3-how-to/260946 "2021-01-13T07:42:26Z")
docker run docker.elastic.co/beats/filebeat:7.10.1 When I exec into above container and check Python version it is 2.7.5 How can I upgrade the python version within container to use 3.x Or is there any other image wit… --- ## [How to reduce storage?](https://discuss.elastic.co/t/how-to-reduce-storage/260903)
**Author:** [@AKP](https://discuss.elastic.co/u/AKP)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 7:39am UTC](https://discuss.elastic.co/t/how-to-reduce-storage/260903 "2021-01-13T07:39:10Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [If condition regex error](https://discuss.elastic.co/t/if-condition-regex-error/260939)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 7:29am UTC](https://discuss.elastic.co/t/if-condition-regex-error/260939 "2021-01-13T07:29:02Z")
Hi, I created a working logstash.conf with if/else conditions. Now I'm trying to implement regex to make the filters less messy. The current filter is like this: filter { if \[tag\] == /^\[a|b|c\]\*$/ { muta… --- ## [Error response code 503](https://discuss.elastic.co/t/error-response-code-503/260940)
**Author:** [@Tabriz](https://discuss.elastic.co/u/Tabriz)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 6:48am UTC](https://discuss.elastic.co/t/error-response-code-503/260940 "2021-01-13T06:48:10Z")
1 on kibana web interface appears that error message \> No result data 2 on redhat 6 logstash service down automatically 3 ithere are n the logstash log file errors a)too many attempts at sending even,dropping b)ret… --- ## [What happens when decommission a node?](https://discuss.elastic.co/t/what-happens-when-decommission-a-node/260938)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 6:25am UTC](https://discuss.elastic.co/t/what-happens-when-decommission-a-node/260938 "2021-01-13T06:25:35Z")
I just decommissioned a node from my cluster. I noticed there are many threads (15-20) doing the shard relocation, which is great. After about 30 minutes, the rebalancing threads dropped down to 3, which is my cluster … --- ## [Scripted field](https://discuss.elastic.co/t/scripted-field/260675)
**Author:** [@Jerry\_Yap](https://discuss.elastic.co/u/Jerry_Yap)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 6:06am UTC](https://discuss.elastic.co/t/scripted-field/260675 "2021-01-13T06:06:43Z")
Hi all, My index fields consists of index\_name (containing P01, P02) X (numbers) How can i scripted the field to display the subtracted result of P01 of X - P02 of X? Thanks in advance. --- ## [Unable to restrict duplicate documents using http\_poller](https://discuss.elastic.co/t/unable-to-restrict-duplicate-documents-using-http-poller/260511)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [January 8, 2021, 8:06am UTC](https://discuss.elastic.co/t/unable-to-restrict-duplicate-documents-using-http-poller/260511 "2021-01-08T08:06:55Z")
Hi All, I have been trying to ingest some, time series data into elasticsearch using logstash http poller plugin. my data is from a monitoring tool which capture the parameters like hostname, memory usage, cpu load, s… --- ## [No answers for bulk requests](https://discuss.elastic.co/t/no-answers-for-bulk-requests/260933)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 5:18am UTC](https://discuss.elastic.co/t/no-answers-for-bulk-requests/260933 "2021-01-13T05:18:46Z")
Hi, as I wrote in name of topic I have troubles with bulk requests (also with Follower Checker and Leader Checker messages). Usual bulk trace looks like: \[2021-01-13T08:30:44,163\]\[TRACE\]\[o.e.h.HttpTracer \] \[h1-… --- ## [Document count increase every time with jdbc driver](https://discuss.elastic.co/t/document-count-increase-every-time-with-jdbc-driver/260932)
**Author:** [@beachjf](https://discuss.elastic.co/u/beachjf)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 5:18am UTC](https://discuss.elastic.co/t/document-count-increase-every-time-with-jdbc-driver/260932 "2021-01-13T05:18:41Z")
input { jdbc { jdbc\_driver\_library =\> "" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_connection\_string =\> "jdbc:sqlserver://aasdf;instanceName=aaSQL;databasename=aaa" jdbc\_u… --- ## [\[esaggs\] \> too many requests is showing on dashboard](https://discuss.elastic.co/t/esaggs-too-many-requests-is-showing-on-dashboard/260878)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 8\ **Last updated:** [January 13, 2021, 4:47am UTC](https://discuss.elastic.co/t/esaggs-too-many-requests-is-showing-on-dashboard/260878 "2021-01-13T04:47:20Z")
Hi, I am getting \[esaggs\] \> too many requests on my Dashboard. Cannot find any solution for that. Please help Thanks . Regards Rohit. [Previous page](https://discuss.elastic.co/latest.md?page=1895) [Next page](https://discuss.elastic.co/latest.md?page=1897)